angr/angr

tracer: resync logic needed for conditional instructions

Open

#2527 aperta il 11 feb 2021

Vedi su GitHub
 (13 commenti) (0 reazioni) (1 assegnatario)Python (1031 fork)batch import
bughelp wanted

Metriche repository

Star
 (6947 star)
Metriche merge PR
 (Merge medio 23h 17m) (98 PR mergiate in 30 g)

Descrizione

This may be I don't understand ARM.

In the following snippet, the block should end at 0x3DB38

text:0003DB14                 CMN             R2, #0x10
.text:0003DB18                 LDMGE           R1!, {R3,R4,R12,LR}
.text:0003DB1C                 STMGE           R0!, {R3,R4,R12,LR}
.text:0003DB20                 SUBGE           R2, R2, #0x10
.text:0003DB24                 POP             {R4}
.text:0003DB28
.text:0003DB28 loc_3DB28                               ; CODE XREF: memcpy_0+34↑j
.text:0003DB28                 ADDS            R2, R2, #0x14
.text:0003DB2C
.text:0003DB2C loc_3DB2C                               ; CODE XREF: memcpy_0+78↓j
.text:0003DB2C                 LDMGE           R1!, {R3,R12,LR}
.text:0003DB30                 STMGE           R0!, {R3,R12,LR}
.text:0003DB34                 SUBSGE          R2, R2, #0xC
.text:0003DB38                 BGE             loc_3DB2C

angr generates the correct basic block. However, when trying to execute the snippet, somehow angr can stop execution prematurely at 0x0003DB1C which confuses me.

Everything to replicate the issue is attached as follow

https://gist.github.com/Kyle-Kyle/92371cad52f772a38e9a0eed9cf0551b

Guida contributor